StackRadarChart IndexLive demo

CVE-2019-16777

High

Advisory

Published 13 Dec 2019In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 7.7; base score, highest
EPSS: 0.020; 80th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 59; of 17,781 indexed, latest versions
Container images: 56; deployed by those charts
Fix available: 1 of 2; affected packages

npm Vulnerable to Global node_modules Binary Overwrite

Carried by container images the latest versions of 59 of 17,781 indexed charts deploy, on 56 images.

Affected package	Affected versions	Fixed in	Images
npmnpm	1.0.1, 1.39.1-prel, 3.5.2, 3.10.3+13 more	6.13.4	53
npmdeb	3.5.2-0ubuntu4, 6.14.4+ds-1ubuntu2, 9.2.0~ds1-2	no fix listed	6

OSV records: GHSA-4328-8hgf-7wjr UBUNTU-CVE-2019-16777

Charts affected

59 by stars

Chart

Latest

Affected images

Radar Score

openwhiskopenwhisk

1 of 10 See more

openwhisk openwhisk 1.0.0

1 of the 10 container images this version deploys carry CVE-2019-16777.

Container image	Digest	Package	Fixed in
openwhisk/ow-utils :1.0.0	c80dba0de3aa	npm@3.5.2-0ubuntu4 npm@3.5.2	no fix listed 6.13.4

Open the chart page →

36,215

hive-selfservice-ui-nodeory

1 of 1 See more

hive-selfservice-ui-node ory 0.1.0

1 of the 1 container images this version deploys carry CVE-2019-16777.

Container image	Digest	Package	Fixed in
oryd/hive-selfservice-ui-node :v0.0.4	26347ef0a2de	npm@6.12.0	6.13.4

Open the chart page →

1,986

1 of 7 See more

bookinfo rgnu 1.0.0

1 of the 7 container images this version deploys carry CVE-2019-16777.

Container image	Digest	Package	Fixed in
istio/examples-bookinfo-ratings-v1 :1.14.0	eb0f1a725ca8	npm@6.9.0	6.13.4

Open the chart page →

20,462

istio-bookinforgnu

1 of 7 See more

istio-bookinfo rgnu 1.0.2

1 of the 7 container images this version deploys carry CVE-2019-16777.

Container image	Digest	Package	Fixed in
istio/examples-bookinfo-ratings-v1 :1.14.0	eb0f1a725ca8	npm@6.9.0	6.13.4

Open the chart page →

20,462

logsmo-helm-chart

1 of 6 See more

log smo-helm-chart 6.0.0

1 of the 6 container images this version deploys carry CVE-2019-16777.

Container image	Digest	Package	Fixed in
taskrabbit/elasticsearch-dump :latest	c967fe68b9c7	npm@6.12.0	6.13.4

Open the chart page →

29,220

pombasmo-helm-chart

1 of 17 See more

pomba smo-helm-chart 6.0.0

1 of the 17 container images this version deploys carry CVE-2019-16777.

Container image	Digest	Package	Fixed in
taskrabbit/elasticsearch-dump :latest	c967fe68b9c7	npm@6.12.0	6.13.4

Open the chart page →

29,220

pachydermstatcan

1 of 4 See more

pachyderm statcan 0.5.1

1 of the 4 container images this version deploys carry CVE-2019-16777.

Container image	Digest	Package	Fixed in
pachyderm/grpc-proxy :0.4.9	2b27f41d4d02	npm@6.4.1	6.13.4

Open the chart page →

4,967

grafanasvtech-public-helm-charts

1 of 2 See more

grafana svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2019-16777.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_grafana :v1.2.2	1d71314424aa	npm@6.14.4+ds-1ubuntu2	no fix listed

Open the chart page →

10,902

helloworldyotron-helm-charts

1 of 1 See more

helloworld yotron-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2019-16777.

Container image	Digest	Package	Fixed in
a5hut0sh/helloworld :1.0	2ae77620e616	npm@6.5.0-next.0	6.13.4

Open the chart page →

1,309

Container images carrying it

56 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
pachyderm/grpc-proxy :0.4.9	2b27f41d4d02	npm@6.4.1	6.13.4	1
socialmediamacroscope/smile_graphql :0.3.1	c5095e94bc65	npm@5.10.0	6.13.4	1
svtechnmaa/svtech_grafana :v1.2.2	1d71314424aa	npm@6.14.4+ds-1ubuntu2	no fix listed	1
timothyclarke/wptagent :2018-01-23	22c41e5ca7e2	npm@4.2.0	6.13.4	1
willwill/kube-slack :v4.1.1	d443017aae98	npm@6.4.1	6.13.4	1
ghcr.io/cosmo-workspace/dev-code-server :v0.0.3	16fda01ae58a	npm@1.0.1	6.13.4	1